Index: sbin/ip6fw/ip6fw.c
===================================================================
RCS file: /usr/home/ncvs/src/sbin/ip6fw/ip6fw.c,v
retrieving revision 1.1
diff -u -r1.1 ip6fw.c
--- sbin/ip6fw/ip6fw.c	2000/01/29 13:54:44	1.1
+++ sbin/ip6fw/ip6fw.c	2001/01/22 19:43:54
@@ -363,7 +363,7 @@
 		if (chain->fw_ip6nopt & IPV6_FW_IP6OPT_OPTS)   PRINTOPT("!opts");
 	}
 
-	if (chain->fw_tcpf & IPV6_FW_TCPF_ESTAB)
+	if (chain->fw_ipflg & IPV6_FW_IF_TCPEST)
 		printf(" established");
 	else if (chain->fw_tcpf == IPV6_FW_TCPF_SYN &&
 	    chain->fw_tcpnf == IPV6_FW_TCPF_ACK)
@@ -1052,7 +1052,7 @@
 		}
 		if (rule.fw_prot == IPPROTO_TCP) {
 			if (!strncmp(*av,"established",strlen(*av))) {
-				rule.fw_tcpf  |= IPV6_FW_TCPF_ESTAB;
+				rule.fw_ipflg |= IPV6_FW_IF_TCPEST;
 				av++; ac--; continue;
 			}
 			if (!strncmp(*av,"setup",strlen(*av))) {
Index: sys/netinet6/ip6_fw.c
===================================================================
RCS file: /usr/home/ncvs/src/sys/netinet6/ip6_fw.c,v
retrieving revision 1.2.2.3
diff -u -r1.2.2.3 ip6_fw.c
--- sys/netinet6/ip6_fw.c	2000/10/24 19:27:39	1.2.2.3
+++ sys/netinet6/ip6_fw.c	2001/01/22 19:43:54
@@ -149,9 +149,15 @@
 {
 	u_char		flg_set, flg_clr;
 	
-	if ((f->fw_tcpf & IPV6_FW_TCPF_ESTAB) &&
-	    (tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK)))
-		return 1;
+	/*
+	 * If an established connection is required, reject packets that
+	 * have only SYN of RST|ACK|SYN set.  Otherwise, fall through to
+	 * other flag requirements.
+	 */
+	if ((f->fw_ipflg & IPV6_FW_IF_TCPEST) &&
+	    ((tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK |
+	    IPV6_FW_TCPF_SYN)) == IPV6_FW_TCPF_SYN))
+		return 0;
 
 	flg_set = tcp6->th_flags & f->fw_tcpf;
 	flg_clr = tcp6->th_flags & f->fw_tcpnf;
@@ -571,7 +577,9 @@
 			}
 			PULLUP_TO(off + 14);
 			tcp6 = (struct tcphdr *) ((caddr_t)ip6 + off);
-			if (f->fw_tcpf != f->fw_tcpnf && !tcp6flg_match(tcp6, f))
+			if (((f->fw_tcpf != f->fw_tcpnf) ||
+			   (f->fw_ipflg & IPV6_FW_IF_TCPEST))  &&
+			   !tcp6flg_match(tcp6, f))
 				continue;
 			src_port = ntohs(tcp6->th_sport);
 			dst_port = ntohs(tcp6->th_dport);
Index: sys/netinet6/ip6_fw.h
===================================================================
RCS file: /usr/home/ncvs/src/sys/netinet6/ip6_fw.h,v
retrieving revision 1.3.2.2
diff -u -r1.3.2.2 ip6_fw.h
--- sys/netinet6/ip6_fw.h	2000/10/24 19:27:39	1.3.2.2
+++ sys/netinet6/ip6_fw.h	2001/01/22 19:43:54
@@ -59,6 +59,7 @@
     u_short fw_number;			/* Rule number */
     u_short fw_flg;			/* Flags word */
 #define IPV6_FW_MAX_PORTS	10	/* A reasonable maximum */
+    u_int fw_ipflg;			/* IP flags word */
     u_short fw_pts[IPV6_FW_MAX_PORTS];	/* Array of port numbers to match */
     u_char fw_ip6opt,fw_ip6nopt;	/* IPv6 options set/unset */
     u_char fw_tcpf,fw_tcpnf;		/* TCP flags set/unset */
@@ -137,6 +138,11 @@
 
 #define IPV6_FW_F_MASK	0xFFFF	/* All possible flag bits mask		*/
 
+/* 
+ * Flags for the 'fw_ipflg' field, for comparing values of ip and its protocols. */
+#define	IPV6_FW_IF_TCPEST 0x00000020	/* established TCP connection	*/
+#define IPV6_FW_IF_TCPMSK 0x00000020	/* mask of all TCP values */
+
 /*
  * For backwards compatibility with rules specifying "via iface" but
  * not restricted to only "in" or "out" packets, we define this combination
@@ -171,7 +177,6 @@
 #define IPV6_FW_TCPF_PSH	TH_PUSH
 #define IPV6_FW_TCPF_ACK	TH_ACK
 #define IPV6_FW_TCPF_URG	TH_URG
-#define IPV6_FW_TCPF_ESTAB	0x40
 
 /*
  * Main firewall chains definitions and global var's definitions.

Index: sbin/ipfw/ipfw.c
===================================================================
RCS file: /usr/home/ncvs/src/sbin/ipfw/ipfw.c,v
retrieving revision 1.80.2.7
retrieving revision 1.80.2.8
diff -u -r1.80.2.7 -r1.80.2.8
--- sbin/ipfw/ipfw.c	2000/10/17 13:44:55	1.80.2.7
+++ sbin/ipfw/ipfw.c	2001/01/10 03:43:33	1.80.2.8
@@ -426,7 +426,7 @@
 		if (chain->fw_ipnopt & IP_FW_IPOPT_TS)   PRINTOPT("!ts");
 	} 
 
-	if (chain->fw_tcpf & IP_FW_TCPF_ESTAB) 
+	if (chain->fw_ipflg & IP_FW_IF_TCPEST)
 		printf(" established");
 	else if (chain->fw_tcpf == IP_FW_TCPF_SYN &&
 	    chain->fw_tcpnf == IP_FW_TCPF_ACK)
@@ -1893,7 +1893,7 @@
 		}
 		if (rule.fw_prot == IPPROTO_TCP) {
 			if (!strncmp(*av,"established",strlen(*av))) { 
-				rule.fw_tcpf  |= IP_FW_TCPF_ESTAB;
+				rule.fw_ipflg |= IP_FW_IF_TCPEST;
 				av++; ac--; continue;
 			}
 			if (!strncmp(*av,"setup",strlen(*av))) { 
Index: sys/netinet/ip_fw.c
===================================================================
RCS file: /usr/home/ncvs/src/sys/netinet/ip_fw.c,v
retrieving revision 1.131.2.10
retrieving revision 1.131.2.11
diff -u -r1.131.2.10 -r1.131.2.11
--- sys/netinet/ip_fw.c	2000/11/07 09:50:58	1.131.2.10
+++ sys/netinet/ip_fw.c	2001/01/10 03:43:34	1.131.2.11
@@ -244,10 +244,16 @@
 tcpflg_match(struct tcphdr *tcp, struct ip_fw *f)
 {
 	u_char		flg_set, flg_clr;
-	
-	if ((f->fw_tcpf & IP_FW_TCPF_ESTAB) &&
-	    (tcp->th_flags & (IP_FW_TCPF_RST | IP_FW_TCPF_ACK)))
-		return 1;
+
+	/*
+	 * If an established connection is required, reject packets that
+	 * have only SYN of RST|ACK|SYN set.  Otherwise, fall through to
+	 * other flag requirements.
+	 */
+	if ((f->fw_ipflg & IP_FW_IF_TCPEST) &&
+	    ((tcp->th_flags & (IP_FW_TCPF_RST | IP_FW_TCPF_ACK |
+	    IP_FW_TCPF_SYN)) == IP_FW_TCPF_SYN))
+		return 0;
 
 	flg_set = tcp->th_flags & f->fw_tcpf;
 	flg_clr = tcp->th_flags & f->fw_tcpnf;
@@ -1208,7 +1214,9 @@
 
 			if (f->fw_tcpopt != f->fw_tcpnopt && !tcpopts_match(tcp, f))
 				continue;
-			if (f->fw_tcpf != f->fw_tcpnf && !tcpflg_match(tcp, f))
+			if (((f->fw_tcpf != f->fw_tcpnf) ||
+			    (f->fw_ipflg & IP_FW_IF_TCPEST))  &&
+			    !tcpflg_match(tcp, f))
 				continue;
 			goto check_ports;
 		    }
Index: sys/netinet/tcp.h
===================================================================
RCS file: /usr/home/ncvs/src/sys/netinet/tcp.h,v
retrieving revision 1.13
retrieving revision 1.13.2.2
diff -u -r1.13 -r1.13.2.2
--- sys/netinet/tcp.h	2000/01/09 19:17:25	1.13
+++ sys/netinet/tcp.h	2001/01/09 18:25:18	1.13.2.2
@@ -67,7 +67,9 @@
 #define	TH_PUSH	0x08
 #define	TH_ACK	0x10
 #define	TH_URG	0x20
-#define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG)
+#define	TH_ECE	0x40
+#define	TH_CWR	0x80
+#define	TH_FLAGS	(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
 
 	u_short	th_win;			/* window */
 	u_short	th_sum;			/* checksum */
Index: sys/netinet/ip_fw.h
===================================================================
RCS file: /usr/home/ncvs/src/sys/netinet/ip_fw.h,v
retrieving revision 1.47.2.3
retrieving revision 1.47.2.5
diff -u -r1.47.2.3 -r1.47.2.5
--- sys/netinet/ip_fw.h	2000/08/22 00:33:18	1.47.2.3
+++ sys/netinet/ip_fw.h	2001/01/10 03:43:34	1.47.2.5
@@ -62,6 +62,7 @@
 #define IP_FW_ICMPTYPES_DIM	(IP_FW_ICMPTYPES_MAX / (sizeof(unsigned) * 8))
 	unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
 	} fw_uar;
+    u_int fw_ipflg;			/* IP flags word */
     u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
     u_char fw_tcpopt,fw_tcpnopt;	/* TCP options set/unset */
     u_char fw_tcpf,fw_tcpnf;		/* TCP flags set/unset */
@@ -208,6 +209,12 @@
 #define IP_FW_F_MASK	0x1FFFFFFF	/* All possible flag bits mask		*/
 
 /*
+ * Flags for the 'fw_ipflg' field, for comparing values of ip and its protocols.
+ */
+#define	IP_FW_IF_TCPEST	0x00000020	/* established TCP connection */
+#define	IP_FW_IF_TCPMSK	0x00000020	/* mask of all TCP values */
+
+/*
  * For backwards compatibility with rules specifying "via iface" but
  * not restricted to only "in" or "out" packets, we define this combination
  * of bits to represent this configuration.
@@ -247,7 +254,6 @@
 #define IP_FW_TCPF_PSH		TH_PUSH
 #define IP_FW_TCPF_ACK		TH_ACK
 #define IP_FW_TCPF_URG		TH_URG
-#define IP_FW_TCPF_ESTAB	0x40
 
 /*
  * Main firewall chains definitions and global var's definitions.
